This site uses cookies to store information on your computer. Some are essential to make our site work; others help us improve the user experience. By using the site, you consent to the placement of these cookies. Read our privacy policy to learn more.

How board members can perform oversight of cybersecurity risks

With organizations’ technology and systems under constant attack from hackers, cybersecurity oversight has become an increasingly important responsibility for board members.

New laws and regulations for managing and reporting on data security and cybersecurity risks create additional challenges for companies as they work to stay on top of the latest security trends and keep their systems and data safe.

A new tool from the Center for Audit Quality, which is affiliated with the AICPA, provides board members with questions they can use in discussions with management and CPA firms about cybersecurity risks and disclosures.

The questions are related to:

Understanding how the financial statement auditor considers cybersecurity risk. Questions board members can ask include: How are cybersecurity risks that auditors identify addressed in the audit process? What impact would a cybersecurity breach have on the auditor’s assessment of internal control over financial reporting?

Understanding the role of management and the responsibilities of the financial statement auditor related to cybersecurity disclosures. Board members’ questions may include the following: How has management considered cybersecurity risks in its ability to report on information required in SEC filings? What does the auditor consider related to cybersecurity disclosures?

Understanding management’s approach to cybersecurity risk management. Among the questions board members can ask: What framework does management use in designing its cybersecurity risk management program? What processes are in place to periodically evaluate the cybersecurity risk program and controls?

Understanding how CPA firms can assist boards of directors in their oversight of cybersecurity risk management. Board members’ questions may include the following: What additional offerings can CPA firms provide related to cybersecurity, since the financial statement auditor’s focus is on IT risks that affect financial reporting?

There are over 30 million small businesses in the U.S., and many of them are optimistic in their outlook. Are you familiar with the obstacles and opportunities they are facing? Test your small business acumen with this quiz sponsored by Chase Ink®.